CVE-2026-16626CWE-611xxe

CVE-2026-16626

published August 10, 2026

CVSS
9.3
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server.

This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00454 · 38.4th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-08-10T22:17Z
References (1)
https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-august-05-2026-jasperreports-server-cve-2026-16626-r12/ · db6d2600-d19b-4111-a010-f3c4ed70cd50
EPSS history
Timeline
  • 10 AUG 18:00Z
    JasperReports Server: XXE Injection Vulnerability (Unauthenticated)
    cvelistv5